[java-idp-oidc] branch main updated: JOIDC-81 - Profile config flag refreshTokensEnabled not honored by the token flow

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=115e3d09c59ec70863f4a1af99ea0e7be4535204

The following commit(s) were added to refs/heads/main by this push:
     new 115e3d09 JOIDC-81 - Profile config flag refreshTokensEnabled not honored by the token flow
115e3d09 is described below

commit 115e3d09c59ec70863f4a1af99ea0e7be4535204
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Mar 17 12:25:13 2022 +0200

    JOIDC-81 - Profile config flag refreshTokensEnabled not honored by the token flow
    
    https://shibboleth.atlassian.net/browse/JOIDC-81
    
    Added activation condition for the SetRefreshTokenToResponseContext action: the action
    is only run if the profile configuration flag for refresh tokens is enabled.
---
 .../idp/flows/oidc/token/token-beans.xml           |  6 +++-
 .../plugin/oidc/op/profile/flow/TokenFlowTest.java | 34 ++++++++++++++++++++--
 .../src/test/resources/conf/relying-party.xml      | 14 +++++++++
 3 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 42335aa3..29852f48 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -353,7 +353,11 @@
 
     <bean id="SetRefreshTokenToResponseContext"
         class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRefreshTokenToResponseContext" scope="prototype"
-        c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}" />
+        c:sealer-ref="#{'%{idp.oidc.tokenSealer:shibboleth.oidc.TokenSealer}'.trim()}">
+        <property name="activationCondition">
+            <bean class="net.shibboleth.oidc.profile.config.logic.RefreshTokensEnabledPredicate" />
+        </property>
+    </bean>
 
     <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell"
         scope="prototype" p:activationCondition-ref="IssueIDTokenCondition" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index 79d337fa..fd4ec46f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -69,7 +69,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
     String clientIdPkceS256 = "mockClientIdPKCES256";
     String codeVerifier = "9234567812345678123456781234567812345678123456781234567812345678";
 
-    Scope scope = Scope.parse("openid profile email");
+    Scope scope = Scope.parse("openid profile email offline_access");
     
     @Autowired
     @Qualifier("shibboleth.StorageService")
@@ -154,9 +154,39 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
         Assert.assertNotNull(response.getTokens().getAccessToken());
+        Assert.assertNotNull(response.getTokens().getRefreshToken());
         Assert.assertNotNull(response.getOIDCTokens().getIDToken());
     }
 
+    @Test
+    public void testValidGrantRefreshTokensDisabledInSSOProfile() throws Exception {
+        final String clientId = "mockClientIdNoRefreshTokensInSSOProfile";
+        initializeGrantAndRequest(clientId, createRequestParameters(redirectUri,
+                "authorization_code",
+                buildAuthorizationCode(clientId), clientId));
+        storeConsent(storageService, "jdoe", clientId, "mail");
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+        Assert.assertNotNull(response.getTokens().getAccessToken());
+        Assert.assertNull(response.getTokens().getRefreshToken());
+        Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+    }
+
+    @Test
+    public void testValidGrantRefreshTokensDisabledInTokenProfile() throws Exception {
+        final String clientId = "mockClientIdNoRefreshTokensInTokenProfile";
+        initializeGrantAndRequest(clientId, createRequestParameters(redirectUri,
+                "authorization_code",
+                buildAuthorizationCode(clientId), clientId));
+        storeConsent(storageService, "jdoe", clientId, "mail");
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final OIDCTokenResponse response = parseSuccessResponse(result, OIDCTokenResponse.class);
+        Assert.assertNotNull(response.getTokens().getAccessToken());
+        Assert.assertNull(response.getTokens().getRefreshToken());
+        Assert.assertNotNull(response.getOIDCTokens().getIDToken());
+    }
+
+    //mockClientIdPKCEPlainUnforced
     @Test
     public void testValidGrantWithRequestedScope() throws Exception {
         final Map<String,String> params = createRequestParameters(redirectUri, "authorization_code",
@@ -237,7 +267,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
             final JSONObject deliveryClaimsUserInfo) throws Exception {
         return ValidateGrantTest.buildAuthorizationCode(clientId, "https://op.example.org", "jdoe", "mock",
                 redirectUri, verifier, deliveryClaims, deliveryClaimsIDToken, deliveryClaimsUserInfo, 
-                "openid profile email").toString();
+                "openid profile email offline_access").toString();
     }
     
     protected String buildLegacyAuthorizationCode(final String clientId, final String... consentedClaims)
diff --git a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
index 8e6d1c45..0729340c 100644
--- a/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/conf/relying-party.xml
@@ -58,6 +58,20 @@
     </bean>
 
     <util:list id="shibboleth.RelyingPartyOverrides">
+        <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdNoRefreshTokensInSSOProfile">
+            <property name="profileConfigurations">
+                 <list>
+                     <bean parent="OIDC.SSO.MDDriven" p:refreshTokensEnabled="false"/>
+                 </list>
+            </property>
+        </bean>
+        <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdNoRefreshTokensInTokenProfile">
+            <property name="profileConfigurations">
+                 <list>
+                     <bean parent="OAUTH2.Token.MDDriven" p:refreshTokensEnabled="false"/>
+                 </list>
+            </property>
+        </bean>
         <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdPKCEPlainUnforced">
             <property name="profileConfigurations">
                  <list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.